4 ms·

This could be a much longer answer, but jails have nowhere near the level of control and isolation a "real" VM does even with the relatively recent additions of

This could be a much longer answer, but jails have nowhere near the level of control and isolation a "real" VM does even with the relatively recent additions of things like vimage and HRL's. Jails are awesome and I have used them for many years, but they are not a replacement for a hypervisor for many(most) use cases. That said, when a young upstart was trying to sell me on Linux superiority and described Docker to me, all I could do was snicker.

feld 11y ago
Explain yourself. A hypervisor is not a security layer, so what is your reasoning?
- GalacticDomin8r 11y ago
  > A hypervisor is not a security layer Of course it is.
  - feld 11y ago
    It is an expensive container, that is all. Attackers can escape or even steal data from another running VM.
    - GalacticDomin8r 11y ago
      > Attackers can escape or even steal data from another running VM. Then there is a bug and you fix it just like any other security layer.
phaemon 11y ago
Docker is not the same thing as FreeBSD jails. Docker is available on FreeBSD (as of June this year) and uses jails.
- GalacticDomin8r 11y ago
  > Docker is not the same thing as FreeBSD jails. No it is not. Like Norton Anti-Virus, it has a much bigger user base. Other than that... > Docker is available on FreeBSD (as of June this year) and uses jails. Huh? I wonder why? ^sarcasm.
  - phaemon 11y ago
    Other than that, they're different things. It's like the difference between lxc and lxd. See https://www.youtube.com/watch?v=LrHW7Vvbie4 https://www.youtube.com/watch?v=LrHW7Vvbie4 for a demo of what lxd can do. Maybe that will clear it up for you.
    - GalacticDomin8r 11y ago
      If the point you're trying to make is linux users love reinventing the wheel and making it more complicated and prone to failure, there really is no need. I believe you. lxd has absolutely no relevance to this discussion. They are not jails, they are not like jails. As noted in my OP in this thread, jails are not a replacement for hypervisors.
      - phaemon 11y ago
        lxd has relevance because it's the same kind of thing as Docker. > They are not jails, they are not like jails. That's what I've been saying.
        GalacticDomin8r 11y ago
        You need to do your research again on docker and lxd. They aren't the same thing at all. > That's what I've been saying. No, you've been saying Docker is so much better than jails. Either you don't know jails or docker or both, I can't tell. Just you really want Docker to be awesome.
toast0 11y ago
For my uses at Y!, jails were great: I was using them to setup test environments that were closer to production: each jail had software to match one of the machine types in production, but I didn't need to get a whole bunch of machines that would mostly be idle. As I was my own jailer, lack of resource limits wasn't a real problem. I greatly benefited from the lack of performance penalties; everything ran at the same speed in or out of the jail. I had one or two systems running in VMs and they were terrible: a) things were clearly slower, b) virtual disk provisioning is terrible, c) timekeeping (hopefully things have gotten better since 2011)

feld 11y ago

Explain yourself. A hypervisor is not a security layer, so what is your reasoning?

GalacticDomin8r 11y ago
> A hypervisor is not a security layer Of course it is.
- feld 11y ago
  It is an expensive container, that is all. Attackers can escape or even steal data from another running VM.
  - GalacticDomin8r 11y ago
    > Attackers can escape or even steal data from another running VM. Then there is a bug and you fix it just like any other security layer.

phaemon 11y ago

Docker is not the same thing as FreeBSD jails. Docker is available on FreeBSD (as of June this year) and uses jails.

GalacticDomin8r 11y ago
> Docker is not the same thing as FreeBSD jails. No it is not. Like Norton Anti-Virus, it has a much bigger user base. Other than that... > Docker is available on FreeBSD (as of June this year) and uses jails. Huh? I wonder why? ^sarcasm.
- phaemon 11y ago
  Other than that, they're different things. It's like the difference between lxc and lxd. See https://www.youtube.com/watch?v=LrHW7Vvbie4 https://www.youtube.com/watch?v=LrHW7Vvbie4 for a demo of what lxd can do. Maybe that will clear it up for you.
  - GalacticDomin8r 11y ago
    If the point you're trying to make is linux users love reinventing the wheel and making it more complicated and prone to failure, there really is no need. I believe you. lxd has absolutely no relevance to this discussion. They are not jails, they are not like jails. As noted in my OP in this thread, jails are not a replacement for hypervisors.
    - phaemon 11y ago
      lxd has relevance because it's the same kind of thing as Docker. > They are not jails, they are not like jails. That's what I've been saying.
      - GalacticDomin8r 11y ago
        You need to do your research again on docker and lxd. They aren't the same thing at all. > That's what I've been saying. No, you've been saying Docker is so much better than jails. Either you don't know jails or docker or both, I can't tell. Just you really want Docker to be awesome.

toast0 11y ago

For my uses at Y!, jails were great: I was using them to setup test environments that were closer to production: each jail had software to match one of the machine types in production, but I didn't need to get a whole bunch of machines that would mostly be idle. As I was my own jailer, lack of resource limits wasn't a real problem. I greatly benefited from the lack of performance penalties; everything ran at the same speed in or out of the jail. I had one or two systems running in VMs and they were terrible: a) things were clearly slower, b) virtual disk provisioning is terrible, c) timekeeping (hopefully things have gotten better since 2011)